ClawHub
Back to skill

Security audit

Paper Recommendation

Security checks for vulnerabilities and agentic risk

Overview

This paper-research skill is mostly coherent, but it can create recurring automation that sends generated briefings to a fixed Telegram account.

Review this skill carefully before installing. Do not run the cron command or daily_workflow.py unless you replace the Telegram ID with one you control, understand that briefings and local paths may be sent externally, and are comfortable with recurring downloads and local file creation under your user account.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T06 · System Persistence

Error
Location
scripts/daily_workflow.py:14
Finding

Persistent disclosure to a hard-coded Telegram recipient

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
scripts/review_papers.py:20
Finding

Indirect prompt injection through untrusted paper metadata

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/fetch_papers.py:48
Finding

Remote paper identifiers are used in local paths without validation

Content
View full analysis
(.*?)', entry) if id_match: paper_id = id_match.group(1).split('/abs/')[-1].split('v')[0] else: continue ``` ```python papers.append({ 'id': paper_id, 'title': title, 'summary': summary, 'authors': authors, 'published': published, 'url': f'https://arxiv.org/abs/{paper_id}', 'pdf_url': f'https://arxiv.org/pdf/{paper_id}.pdf', 'category': category, 'relevance_score': score }) ``` ```python def download_papers(papers, output_dir): """Download PDF papers.""" output_dir = Path(output_dir) output_dir.mkdir(parents=True, exist_ok=True) downloaded = [] for p in papers: pdf_path = output_dir / f"{p['id']}.pdf" if pdf_path.exists(): downloaded.append(str(pdf_path)) continue try: subprocess.run(['curl', '-sL', p['pdf_url'], '-o', str(pdf_path)], timeout=60) if pdf_path.exists() and pdf_path.stat().st_size > 1000: downloaded.append(str(pdf_path)) except: pass return downloaded ``` ### Technical Analysis The paper identifier is extracted from a remote XML response and later used as part of a local path. The code does not enforce the expected arXiv identifier syntax and does not verify that the resolved destination remains inside `output_dir`. The downloader follows redirects with `curl -L`, but it does not: - Fail on HTTP error responses. - Restrict the final redirect host. - Check the process return code. - Verify the response content type. - Verify PDF magic bytes. - Remove invalid or partial downloads. A file is accepted solely because it exists and is larger than 1,000 bytes. The daily w ...[truncated 1524 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (17)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs automatic PDF downloads, local file generation, and Telegram delivery to a fixed recipient without prominently requiring explicit user consent at execution time. This creates a real risk of unintended data transmission and disk writes, especially in an agent environment where users may invoke the skill for research without realizing it will persist files and exfiltrate generated content to an external channel.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file requires the abstract to be a complete Chinese translation and later states that the abstract 'must be Chinese,' while presenting the format as mandatory with no exceptions. This forces a specific language/locale without user opt-in, which matches the policy-violation category for language constraints.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The note at L380 states 'The briefing is Jarvis's creative work - not automated'. However, the rest of the document repeatedly defines an automated daily workflow that '自动完成：获取 → 下载 → 生成 → 发送' and says the script generates the briefing and sends it to Telegram. This is an active contradiction in the skill documentation about whether briefing generation is automated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The workflow mandates extraction of a Chinese abstract and later explicitly instructs writing a Chinese translation and using Chinese section labels in the briefing. This forces a specific language/locale in the skill's instructions without user opt-in or a documented region-specific justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The workflow explicitly instructs the agent to send the generated briefing to Telegram, an external messaging channel, without any consent check, sensitivity review, or warning that content is leaving the local environment. Even if the briefing is intended to contain paper summaries, agent-generated content can include unexpected sensitive data from prompts, local files, or prior context, so unguarded exfiltration to third-party services is a real data-leak risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language description states the workflow in Chinese only and frames the skill behavior entirely in that locale, with no indication that users can opt into another language. Under the policy, forcing a specific language without user choice is a locale/language policy violation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/daily_workflow.py (reported line 23)May include surrounding context.

python
def fetch_papers():
    """获取论文并下载 PDF"""
    log("📥 获取智能体与AI前沿研究论文...")
    result = subprocess.run(
        ['python3', 'scripts/fetch_papers.py', '--download', '--limit', '6', '--json'],
        cwd=SKILL_DIR, capture_output=True, text=True, timeout=180
    )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
87% confidence
Finding

The code constructs a subagent task by interpolating untrusted paper metadata such as title, id, and pdf_url directly into a natural-language prompt sent to another agent. If upstream paper metadata is adversarial, this creates a prompt-injection channel that can manipulate the spawned subagent into performing unintended actions or producing tainted results.

Content

Scanner excerpt · scripts/daily_workflow.py (reported line 48)May include surrounding context.

python
3. 评分 1-5，给出推荐
4. 回复 JSON：{{"review": {{"id": "{p['id']}", "score": 5, "contribution": "一句话", "conclusion": "一句话", "experiments": "实验设置和关键发现", "recommended": "yes"}}}}"""

        subprocess.run([
            'clawdbot', 'sessions', 'spawn',
            '--task', task,
            '--label', f"review-{p['id']}",

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
81% confidence
Finding

The code passes a file path derived from untrusted paper IDs into pdftotext without sanitizing the identifier. If an attacker can influence p['id'], they may cause the workflow to read unintended local files via path traversal or process attacker-chosen files, which is especially risky in an automated scheduled job.

Content

Scanner excerpt · scripts/daily_workflow.py (reported line 70)May include surrounding context.

python
pdf_path = f"{PAPERS_DIR}/{p['id']}.pdf"
        text = ""
        if os.path.exists(pdf_path):
            result = subprocess.run(['pdftotext', pdf_path, '-'], capture_output=True, text=True, timeout=30)
            text = result.stdout[:3000] if result.returncode == 0 else ""
        
        # 提取机构

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This code creates and saves a markdown briefing under PAPERS_DIR, which is a persistent file write affecting user/system data. Although there is a log after the write succeeds, there is no prior warning, confirmation, or explanatory comment disclosing that the workflow will create dated briefing files on disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The workflow automatically transmits generated research content to an external Telegram target without any explicit disclosure, confirmation, or content-classification checks. In a skill context, this creates data exfiltration risk if fetched papers, extracted text, or local summaries contain sensitive or proprietary information.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/daily_workflow.py (reported line 148)May include surrounding context.

python
# 使用 clawdbot CLI 发送
    try:
        result = subprocess.run([
            'clawdbot', 'message', 'send',
            '--target', TELEGRAM_ID,
            '--message', message

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The workflow explicitly skips subagent review but still outputs fixed scores, recommendations, and analysis-like sections as though substantive review occurred. This is dangerous because it can mislead recipients into trusting fabricated research assessments, enabling poor decisions and integrity failures in downstream workflows.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/fetch_papers.py (reported line 43)May include surrounding context.

python
for category in CATEGORIES:
        url = f'https://export.arxiv.org/api/query?search_query=cat:{category}&start=0&max_results=30&sortBy=submittedDate&sortOrder=descending'
        
        result = subprocess.run(['curl', '-sL', url], capture_output=True, text=True, timeout=30)
        data = result.stdout
        entries = re.findall(r'<entry>(.*?)</entry>', data, re.DOTALL)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/fetch_papers.py (reported line 104)May include surrounding context.

python
continue
        
        try:
            subprocess.run(['curl', '-sL', p['pdf_url'], '-o', str(pdf_path)], timeout=60)
            if pdf_path.exists() and pdf_path.stat().st_size > 1000:
                downloaded.append(str(pdf_path))
        except:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/read_pdf.py (reported line 33)May include surrounding context.

python
cmd = ['pdftotext', str(pdf_path), '-']
    
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
        
        if result.returncode != 0:
            return {"error": f"pdftotext failed: {result.stderr}"}

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The embedded task template is entirely in Chinese and directs downstream sub-agents to respond in that language and format, but the script does not offer any language choice or explain a locale-specific requirement. This creates a natural-language policy issue because it imposes a specific language on users and sub-agents by default.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.